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We discuss quantum key distribution protocols using quantum continuous variables. 
We show that such protocols can be made secure against individual gaussian attacks 
regardless the transmission of the optical line between Alice and Bob. This is achieved by 
reversing the reconciliation procedure subsequent to the quantum transmission, that is, 
using Bob's instead of Alice's data to build the key. Although squeezing or entanglement 
may be helpful to improve the resistance to noise, they are not required for the protocols 
to remain secure with high losses. Therefore, these protocols can be implemented very 
simply by transmitting coherent states and performing homodyne detection. 

Here, we show that entanglement nevertheless plays a crucial role in the security anal- 
ysis of coherent state protocols. Every cryptographic protocol based on displaced gaus- 
sian states turns out to be equivalent to an entanglement-based protocol, even though no 
entanglement is actually present. This equivalence even holds in the absence of squeez- 
ing, for coherent state protocols. This "virtual" entanglement is important to assess 
the security of these protocols as it provides an upper bound on the mutual information 
between Alice and Bob if they had used entanglement. The resulting security criteria 
are compared to the separability criterion for bipartite gaussian variables. It appears 
that the security thresholds are well within the entanglement region. This supports the 
idea that coherent state quantum cryptography may be unconditionally secure. 

Keywords: Quantum key distribution, quantum cryptography, continuous variables, co- 
herent states, quantum entanglement 
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1 Introduction 

1.1 Continuous-variable quantum cryptography 

In the presently very active field of continuous variable quantum information processing, a 
stimulating question is whether quantum continuous variables (QCV) PQ may provide a valid 
alternative to the usual "single photon" quantum key distribution (QKD) schemes 0- Many 
recent proposals to use QCV for QKD (for a short review see [3]) have been based upon the 
use of "non-classical" states, such as squeezed or entangled light beams. We have nevertheless 
shown and experimentally demonstrated 0], that there is actually no need for squeezed 
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or entangled light: QKD can be implemented simply by generating and transmitting random 
distributions of coherent states. More precisely, coherent state protocols are secure against in- 
dividual gaussian attacks, while their security with respect to the line transmission depends on 
the reconciliation protocol which is used by Alice and Bob to correct the transmission errors. 
Using the so-called "direct reconciliation" (DR) protocols, a whole family of secure protocols 
can be obtained by using either coherent states, squeezed states, or Einstein-Podolsky-Rosen 
(H| (EPR) entangled beams El Ej ; provided that the transmission of the line is larger than 
50 percent (i.e. the losses are less than 3 dB). The security of these protocols is related to the 
limit imposed on the cloning of gaussian states OH EH > so that non-classical features like 
squeezing or EPR correlations have no influence on the achievable secret key rate. Interest- 
ingly, the 3 dB loss limit of these cryptographic protocols may be circumvented by modifying 
the reconciliation protocol. In ref. 01 ^3 > we have introduced "reverse reconciliation" (RR) 
protocols, and demonstrated their security for any value of the line transmission. Note that 
there exist, in principle, other ways for Alice and Bob to go beyond the 3 dB limit of DR 
protocols, namely by using entanglement purification |12| or postselection |13|. 

In the present paper, we will first review some basic properties of the direct and reverse rec- 
onciliation protocols. Then, we will show that each prepare-and- measure continuous- variable 
protocol is equivalent to an entanglement-based QKD protocol. This equivalence reminds 
us the link between the entanglement-free BB84 protocol ^2] and the EPR-based protocol 
proposed by Ekert |15| that was pointed out in This equivalence allows us to com- 

pute the best estimate Alice may have on Bob's measurement outcome, if she had used an 
entanglement-based protocol. This, in turn, allows us to upper bound the information that 
an eavesdropper, Eve, can have on Bob's measurement results. In the case of a channel with 
losses but no added noise, Eve's estimate turns out to be always worse than Alice's estimate, 
which is the main reason for the increased security achieved by reversing the reconciliation 
protocol. Finally we will compare the security criteria derived from our approach to the 
entanglement criterion for bipartite gaussian variables. It appears that the corresponding se- 
curity thresholds are well within the entanglement region, supporting the idea that coherent 
states quantum cryptography may be unconditionally secure. 

1.2 Direct and reverse reconciliation protocols 

In the first step of a generic QKD protocol, Alice prepares a quantum state and sends it to Bob, 
who makes a measurement on the state. Alternatively, Alice and Bob may share two EPR- 
correlated systems and both make a measurement on their part. In order to warrant security, 
Alice and Bob must randomly choose to use different measurement bases, the transmitted 
data being kept only when the bases are compatible. After the quantum exchange, they thus 
have to agree on a common measurement basis, and discard the wrong measurements. At 
the end of this step, Alice, Bob, and the potential eavesdropper Eve, share a set of correlated 
data, called "key elements" . 

In a second step, Alice reveals some randomly chosen sample of the data that she sent, 
and Bob reveals his corresponding measurements. These samples allow them to measure some 
relevant parameters of the quantum channel, e.g. the error rate and the transmission (called 
"channel gain" for QCV protocols). Knowing the correlations between their key elements, 
Alice and Bob can evaluate the amount of information they share (Tab), and the information 
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the eavesdropper Eve may have at most about their key elements (Iae and I be)- Therefore 
they can evaluate the size of the secret key they will be able to generate at the end of the 
protocol. If Eve knows too much, the size of this secret key will be zero, and Alice and Bob 
abort the protocol at this point. 

In a third step, called "reconciliation", Alice and Bob use classical communications to 
extract a common binary key from their correlated key elements, revealing as little information 
as possible to a third party ignoring these key elements. This step usually uses parity- 
based algorithms like Cascade. It was adapted to continuous variables in Refs. Ej , where 
a "sliced" error correction procedure was devised in order to provide reconciled bits from 
real-values key elements. There are actually two main options for doing the reconciliation, 
depending on whether Alice's or Bob's data are used to build the key. We will call these two 
options "direct reconciliation" (DR) and "reverse reconciliation" (RR) , respectively, and will 
detail these procedures in Sections 11.2.11 and H.2.2I The starting point will be the Csiszar- 
Korner theorem |18l fTT?j stating that a sufficient condition for distilling a secret key is that 
max(iyiB — Iae, Iab — Ibe) > 0, the first and second term corresponding to DR and RR, 
resepctively. 

Finally, the fourth step of a practical QKD protocol consists in Alice and Bob performing 
"privacy amplification" in order to filter out Eve's information. Since this step is based on 
an evaluation of the amount of information collected by Eve on the reconciled key, a crucial 
requirement is to get a bound on Iae for DR, or on Ibe for RR. For a coherent state protocol, 
the DR bound was given in ref. pj], and leads to a security limit for line with a transmission 
of 1/2. In the following, we will establish the RR bound and show that it is not associated 
with a minimum value of the line transmission. In order to have a general approach, we 
will start by considering the exchange of entangled beams, and we will show later that for 
a particular choice of the measurement performed by Alice, this is equivalent to exchanging 
coherent states. 

1.2.1 Direct Reconciliation (DR). 

In direct reconciliation, Alice sends correction information to Bob, who accordingly corrects 
his key elements to have the same values as Alice. Alice infers from her estimate of Iab the 
minimum amount of information she needs to reveal at this step. If the reconciliation protocol 
is perfect, it keeps Iab — Iae constant. After reconciliation, Alice and Bob know a common 
bit string of length Iab (slightly less if the reconciliation protocol is not perfect), and Eve 
knows Iae bits of this string. It will provide a usable secret key if Iab — Iae > 0. We 
call this "direct reconciliation" (DR) because Bob is reconstructing what was sent by Alice, 
and the classical information flow in this step has the same direction as the initial quantum 
information flow. 

Direct reconciliation is quite intuitive, and it was used in the coherent state QCV protocol 
that we proposed in ref. 3 . However, it is not secure as soon as the quantum channel 
transmission falls below 1/2. Intuitively, Eve could simulate the losses by a beam splitter and 
look one output port of this beamsplitter. It seems obvious that, if she keeps the biggest part 
of the beam sent by Alice (i.e. if she simulate losses higher than 3 dB), she can extract more 
information from her beam than Bob (Iae > Iab)-, thus forbidding any secret key generation. 

Note that this limitation is actually not specific to QCV: a "direct" version of BB84 



4 Virtual Entanglement and Reconciliation Protocols for Quantum Cryptography with Continuous Variables 



would be a protocol where Bob would try to fill in the "empty slots" where he did not get any 
photon. Such a protocol actually only works when the losses are smaller than 3 dB. Indeed, 
suppose Alice has a perfect photon-gun and sends single photons to Bob, who measures their 
polarization with perfect detectors. If G < 1 denotes the transmission of the errorless lossy 
channel, Bob only receives and measures a fraction G of these photons. Even if we suppose 
that Bob has a quantum memory, allowing him to always make the right basis choice, we 
have Tab = G. If the losses are due to Eve, which keeps the lost photons, Iae = 1 — G. The 
security condition Iab — Iae > for a "direct" version of BB84 is therefore G > \. The 
usual BB84 protocol works for higher losses because only the photons received by Bob (and 
therefore not intercepted by Eve) are considered for the key. As we will show in Sect. 11.2.21 
this may be viewed as a reverse reconciliation where Alice corrects her value to match the 
ternary digit (0,1, no photon) held by Bob. 

1.2.2 Reverse Reconciliation (RR). 

We may instead reverse the reconciliation in the sense that Bob sends the correction informa- 
tion while Alice corrects her key elements to have the same values as Bob. Since Bob gives 
the correction information (also to Eve), this type of reconciliation keeps Iab — I be constant, 
and provides a usable key if Iab — I be > 0. We call it "reverse reconciliation" (RR) because 
Alice adapts herself to what was received by Bob. 

In a noiseless BB84 with finite line transmission, this step corresponds to Bob informing 
Alice of his "empty slots" where he did not get any photon, and Alice discarding the cor- 
responding bits in order to have the same key. In our QCV protocol, there is no "empty 
slot" since homodyning the vacuum gives a gaussian distribution, and the RR procedure is 
intertwined with error correction. Then, alike BB84, it allows Alice and Bob to cross the 
3-dB loss limit and extract a secret key for an arbitrarily low value of the line transmission. 

However, in a practical realization, one cannot attain very high losses for several reasons. 
First, a realistic reconciliation protocol cannot reach the Shannon limit, so Alice and Bob 
actually obtain only a fraction of the information Iab while one has to assume that Eve gets 
the full information I be- Said otherwise, the correction information that must be sent by Bob 
to Alice (but which is also monitored by Eve) is slightly larger than its ideal value predicted 
by Shannon theory. This makes the information difference vanish at some finite value of the 
line transmission. Another problem which must be taken into account is the following: while 
the RR procedure should be unidirectional (from Bob to Alice), the error correction using 
Cascade is a bidirectional process, so that some information also "leaks" from Alice to Eve. 
We have numerically evaluated this information leakage in practical cases [4 and it appears 
to be small, so we will not consider it further in the present paper. However, it must be kept 
in mind that the one-way or two-way character of the used error correction procedure plays 
a role, which should not be underestimated. 

2 Preparation of a modulated gaussian beam through entanglement 

The QKD protocols of the references 2] El El EH are based on randomly displaced squeezed 
or coherent states prepared by Alice. We will show in this section that Alice could equivalently 
prepare a pair of quantum entangled beams, measure one (or both) quadratures on one beam, 
and send the other beam to Bob. This will be used in Sections [3] and 0] to find the maximum 
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Fig. 1. Measurement of a single quadrature. Alice prepares two entangled beams (Q,P) 
and (Q',P') using an EPR source (EPR). She measures one quadrature on one beam with an 
homodyne detector (H) and deduces from it Qa (or Pa), which is an estimate of Q (or P). She 
sends the other beam to Bob. 



information Alice may have on Bob's data if she was using quantum entangled beams, and 
in Sect. [3 to compare the security conditions with the entanglement criterion for bipartite 
gaussian states. 

2. 1 Measurement of a single quadrature 

Let us assume Alice prepares a pair of EPR beams, and denote by (Q, P) the quadratures of 
the beam sent to Bob and by (Q', P') the quadratures of the beam kept by Alice (see Fig.QJ. 
To simplify the notations, we will suppose those beams to be initially symmetric in the two 
quadratures, i.e. 

(Q 2 ) = (Q' 2 > = V N (P 2 ) = (P' 2 ) = V N , (1) 

where Ao is the shot-noise variance. 

These beams are entangled, and the measurement of a quadrature of one beam (e.g. 
Q') gives Alice information on the same quadrature of the other beam (Q). One can show 
|2()l HT\ that the best estimate Alice can have on Q knowing Q 1 is of the form Qa = otQ 1 
with a = T^ply , the value of a being found by minimizing the variance of the error operator 
SQa — Q — Qa- The conditional variance Vq\q a of Q knowing Qa quantifies the remaining 
uncertainty on Q after the measurement of Q' giving the estimate Qa of Q, and we have 

V QlQA = (SQa 2 ) = (Q 2 ) - ^PjA (2) 

By using the commutation relation 

[SQ A ,P] = [Q,P]-a[Q',P], (3) 

2iN 

which directly follows from the definition of 5Qa, we find that the following uncertainty 
relation on the beam (Q, P) after the measurement of Q 1 holds : 

V q]Qa x (P 2 > > Nl (4) 
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Using the expression (J2J, we obtain 

|(Q'Q)| 2 <(Q' 2 >(Q 2 )-iVo 2 ^- (5) 

By definition, the EPR beams are maximally correlated and saturate this limit, which gives 

N 



(Q' Q) = W^l N V q[Qa = (6) 

Since by measuring Q' Alice deduces Qa, and since Q = Qa + SQa, the beam (Q,P) is 
projected onto a Q-squeezed state of squeezing parameter s = Vq\q a /No = 1/V centered on 
(Qa,0). 

Alternatively, Alice could measure the quadrature P' , yielding the estimator Pa = —aP', 
which gives 

(P'P) = -VV T ~1N V p \ Pa = ^ (7) 

Of course, by measuring P', Alice learns Pa and projects the other beam onto a P-squeezed 
state centered on (0, Pa) with the same squeezing parameter s — 1/V. 

2. 2 Simultaneous measurement of Q' and P' 

Another possibility for Alice is to measure simultaneously Q' and P'. In this case, her 
measurement outcomes are more noisy, so she projects the beam (Q, P) onto a lesser squeezed 
state. A crucial point for our protocol is that she prepares a coherent state if her measurement 
is balanced in Q and P, as we will show below. 

Denoting as Q' A and P' A the values of Q' and P' measurements, the associated added 
noises SQ' A and 8P' A are defined as 

SQ'a =Q'~Q'a 5P' a = P'- P' a , (8) 

A possible way to perform such a joint measurement is to split Alice's beam with a beam- 
splitter of transmission T (in intensity), measuring separately each quadrature at each output 
port of the beamsplitter (see Fig. EJ. Then, Q' A and P' A are the best estimators of Q' and P', 
proportional to the outputs of homodyne detectors placed on each of the output port. 

Since Q' A and P' A are known simultaneously, they commute, [Q'a^P'a] = 0- Therefore, 
[5Q' A , SP A ] — —[Q', P'} and the noise variances obey the following inequality: 

<^ 2 )(<5PA 2 )>iVo 2 . (9) 

If this inequality is saturated, that is if Alice makes an optimal joint measurement, this 
measure is characterized by the positive number u, defined by 

(8Q' A )=iiNo and {8P'/) = - N . (10) 

If the measurement is made with the beamsplitter setup described above, we have 
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Fig. 2. Measurement of both quadratures. Alice can measure both quadratures of her beam, 
as explained in the text, using a beamsplitter of transmission T and two homodyne detectors H. 
She then simultaneously obtains Qa and Pa, which are estimates of Q and P. 



If /j, = 1, Alice measures Q' and P' with the same (shot- noise limited) precision. This 
case corresponds to a 50:50 beamsplitter (T = |). If // < 1, Alice measures Q' with a sub- 
shotnoise accuracy. At the limit /i — > 0, Alice measures perfectly Q' but not at all P', since 
the noise 8P' A needs to be infinite in order to fulfill the Heisenberg inequality 10. This limit 
corresponds to the perfectly transmitting beamsplitter (T — 1), where nothing is reflected 
to the "P- measuring port". If fj, > 1, the situation is reversed, and Alice measures P 1 more 
accurately than Q'. At the limit \i — > oo, she only measures P' , gaining no information on 

Q'- 

Now, from the measured quadratures Q' and P', Alice can again estimate the correlated 
quadratures Q and P. Her best estimate of the state of the beam (Q, P) is given by (Qa, Pa), 
which are now defined simultaneously: 



Qa = 



(QQ'a) { 

(Q'a 2 ) 



Ya 



v + n 



-(Q'-SQ'a) and Pa = - 



Jv 2 - 1 

XI—^(P'-SP A ). (12) 



Using 



Q = Qa + SQj 



and 



P = P A + SP A , 



(13) 



with SQa and SPa defining the noise of the estimators, the conditional variances can be 
expressed as 



Vo 



(SQa 2 ) 



(Q 2 )- 

V + fi 



(QQa) 
(Qa 2 ) 



V 



(V 2 



1 



No 



(14a) 
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towards 
~Bob 



Fig. 3. Equivalent black box. The system sketched in Fig. [2] is equivalent to this black box. 
A random number generator (RNG) gives two values Qa and Pa- A squeezed (or coherent if 
s = 1) state source (Src) generates the beam (&Qa, SPa), wich is then displaced in phase space by 
(Qa,Pa) using a modulator (Mod). 



and 




. YJ^ Na . (14b) 

fiV + l V q \ Qa 

Said otherwise, the measurement of Q' and P' projects the beam (Q, P) onto a squeezed state 
of variances Vq\q a and Vpip A . Then, it is clear that if the measurement is symmetric in Q' 
an P' (i.e. if u = 1), one has Vq\q a = Vp\p A = N and the beam (Q,P) is projected onto a 
coherent state. The mean values of the quadratures of the beam (Q, P) are given by Qa and 
Pa, so things happen as if Alice had prepared a randomly displaced squeezed (or coherent) 
state. 

2.3 Virtual entanglement 

Let us suppose the EPR source and the measuring apparatus of Alice are hidden in a black 
box. The only things coming out of this black box are the values of Qa and Pa, and the 
beam (Q,P). This black box is indistinguishable from an equivalent black box, sketched in 
Fig. |21 where Qa and Pa are chosen by the adequate random generator and the beam (Q, P) 
is in the displaced squeezed state centered around (Qa, Pa)- Its squeezing factor is 



= Vq\Qa = + i 

' S N V + n ' 
and the equations (|14|l can be rewritten 



(15) 



Vq\Qa — ($Qa 2 ) =sNq and V P \ PjL = (6P A 2 ) =^ (16) 

The black box with fi = and in the case Q and P are randomly interchanged allows 
therefore to prepare the randomly displaced squeezed states that are used in the QKD protocol 
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described in [HllZj- If we fix // to any given value, we realize all of the protocols presented in 
In particular, since /i = 1 corresponds to the preparation of a coherent state (s = 1), the 
modulated coherent states QKD protocols used in IH ^2 are equivalent to entanglement- 
based protocols even if they neither use squeezing nor entanglement. This possibility to 
prepare randomly displaced coherent states with an entanglement-based setup was implicitly 
present in our previous security studies of individual gaussian attacks on reverse reconciliation 
protocols 01^2- It is also useful to extend the Gottesman-Preskill proof of unconditional 
security of squeezed-state protocols j22| in an attempt to demonstrate the security of coherent- 
state protocols with respect to general attacks 23 . 

We call this possibility virtual entanglement: even if Alice does not actually use entangle- 
ment to create her coherent (or squeezed) states, there exists an equivalent setup (the black 
box described above) which uses entanglement to create them. This relies on the fact that the 
outputs of any physical apparatus, including Eve's eavesdropping system, can only depend 
on the density matrix of its input (in this case, the beam sent by Alice), and not on the 
way it was prepared. Cryptographic security is then related not to the transmission of "real" 
entanglement, but rather to the ability of the quantum channel to transmit entanglement, as 
we will show below. 

3 Bounding Eve's attack on reverse reconciliation 
3.1 Entangling doner 



Fig. 4. Eve's attack on reverse reconciliation. To attack a reverse reconciliation QKD 
protocol, Eve uses an entangling doner (EC). It takes Alice's beam (Q,P) as input and produces 
two entangled outputs, (Qb,Pb), which is kept by Eve, and (Qs,Pb), which is sent to Bob 
through a perfect line. 

To eavesdrop a reverse reconciliation scheme, Eve needs to guess the results of Bob's 
measurement. We will call entangling doner a system allowing her to do so, because this kind 
of system can be described as a doner creating two entangled outputs, Eve keeping one of 
them and sending the other one to Bob (see Fig.^J. Here (Q,P) are the input quadratures 
of the entangling doner and (Qb,Pb), (Qe,Pe) the quadratures of its two outputs. A good 
entangling doner should minimize the conditional variances |20l 121) Vq b \q e and V Pb \ Pe . 

Alice and Bob should assume Eve uses the best possible entangling doner, knowing the 
Alice-Bob channel quality. This channel can be described by 



{5Qb)=XqN q , (5P 2 b )=xpNq and (Q 5Q B ) = (P 5P B ) = (18) 





and 




(17) 



with 
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3.2 Heisenberg inequalities on Alice's and Eve's conditional variances 

For reverse reconciliation protocols, Alice needs to evaluate Qb- Her estimator can be noted 
BQa, with 8 = = r-^~ s ■ Eve's estimator for P B will be P E - The error of these 

W-B I \/Gq(V+xq) 

estimators are 

Qb\a = Qb- PQa and P B]E = P B - P E . (19) 

The commutator of these two quantities is then equal to 

[Qb\a, Pb\e] = [Qb,Pb] ~ P [Qa, Pb] - [Qb, Pe] +0 [Qa,Pe] ■ (20) 



We have therefore [Qb\a, Pb\e] = [Qb,Pb] = 2iNo. This commutation relation leads to the 
following inequality on conditional variances: 

Vq b \q a V PbIPe >iV 2 and V Pb{Pa V Qb{Qe > iV 2 , (21) 

the second inequality being obtained by exchanging the roles of Q and P. These inequalities 
mean that Alice and Eve cannot jointly know more about Bob's field than allowed by the 
Heisenberg principle. 

3.3 Alice's conditional variance 

Alice's conditional variance on is 

Vq bIQa = (Q 2 B ) - {Q tS B ? = G Q VN a + G q xqN - G Q VN + G Q sN Q 

= G q (xq + s)N (22) 

A similar calculation leads to the symmetric relation 

V PbIPa =G p (xp + ±)N . (23) 

These conditional variances depend on the amount of squeezing s Alice generates with her 
black-box. Therefore, the constraint on squeezing y < s < V gives us the minimal values of 
these conditional variances 

V Pb]Pa > V PB{PA , min = G P ( XP + ±)N (24) 
Vq b \Qa > V QBlQA!min = G Q (xQ + ±)N (25) 

3-4 Eve's conditional variance 

The output-output correlations of an entangling doner, described e.g. by V Pb \ Pb , should only 
depend on the density matrix of the field (Q, P) at its input, and not on the way this field was 
built. The inequality (|2T)l has thus to be fulfilled for every physically allowed value of Vq b \q a , 
given the density matrix of the field (Q, P). Since this field is gaussian, its density matrix is 
uniquely defined by its covariance matrix, i.e. by the parameters (Q 2 ) = (P 2 ) — V Nq and 
(Q P) — 0, and we have to consider all possible black-boxes (those of Fig. [21 as well as those 
of Fig. |3J. In order to bound Eve's knowledge by using Ea. (|21() . we thus have to use the 
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tightest limit on Vq b \q a , which is given by VQ B \Q Atm - m according to Obviously the same 
reasoning holds for Vp B \p A , with the corresponding tightest limit Vp B \p A:mm . 
We have then 

N 

Vq b \Qe ^ VQ B \QB,rmn = ^ ~ TT777T ( 26 ) 



and, similarly 



Vp B \p E > Vp B \p E ^ min 



Gp(xp + l/V) 
Np 

Gq(xq + l/V) 



(27) 



If one of these inequalities was violated and if Alice had prepared her field with an EPR-beams 
based black-box, then Eve and Bob would be able to make a joint measurement of the field 
(Q 1 , P') with a better accuracy than allowed by the Heisenberg uncertainty limit. 

3. 5 Implementation of the entangling doner 



(ftiice) 



(Q,P) 




-(Bob) 



Fig. 5. Implementation of an entangling doner for G < 1. Eve uses a beamsplitter of 
transmission T = 1 — G to inject into the line a partially known noise (Qei, Pei) generated with 
an EPR source (EPR). She keeps the other output (Qe2i Pe2) °f th e beamsplitter which, combined 
with her knowledge (Qknown, flmown) on the injected noise, gives her an estimate of Bob's beam 
(Qb,Pb)- 



In a practical QKD scheme, Alice and Bob will give the same roles to Q and P. Assuming 
therefore that Gq = Gp = G and \Q — Xp = X: the two bounds above reduce to a single 
one, and it is possible to explicitly describe an entangling doner achieving this limit. We will 
consider here only the case where G < 1, but the limit is tight for any G. The entangling 
doner can then be sketched as shown in Fig|3J Eve uses a beamsplitter with a transmission 
G to split up part of the Alice-Bob transmitted signal, and she injects into the other input 
port a field El, with the right variance to induce a noise of variance GxNq at Bob's end. One 
has therefore: 

(Qlr) = ^ (Pk) = ^ (28) 

Eve should know the maximum about this injected field El, and will therefore use an half- 
pair of EPR-correlated beams, so that she does perform an "entangling" attack. We can then 
write 

Qei = Qk nown H~ ^unknown 

(29) 
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where Qknown stand for Eve's best estimation of Qei, given by the measure of its brother- 
beam, and Qunknown stand for the noise she cannot know. We have 

(Q* ) - *° (1 = G)No (30) 

^unknown; (q|^ ^ ) 

(Qknown) = {Q El) ~ {Q unknown) ( 3 -0 

Eve also use an output port of the beamsplitter to measure the field E2, which gives her 
information about the input field: 

Qe2 = VG Qei - VT~GQ- (32) 

She can cancel a part of the noise induced by El by subtracting the part proportional to 
Qknown- Thus she knows 

Q'e2 = V^Qunknown — Vl — G Q. (33) 

We also have 

Q B =VGQ + VT~ GQei- (34) 

where Eve already knows the part proportional to Qknown, injected with Qei and she only 
needs to guess 

Q' B = VGQ + \/l — GQ unknown (35) 

from Q' E2 - We have therefore 

V Qb\Qei,Qe2 = V Q' B \Q' E2 - ( 36 ) 

The calculation of the quantities (Qb), \Q'e2)i (Q'eiQ'b) leads straightforwardly to the con- 
ditional variance 

V Q' B \Q' E2 = q x + ojy = V Q B \Q E ,min (37) 

showing that the entangling doner does reach the lower limit of Eqs. (|26[1 and 1|27|) . 

4 Security of reverse-reconciliation based quantum cryptography 
4-1 Tolerable noise 

In a reverse reconciliation protocol, Eve's power is limited by the values of ^q b |Q E ,min and 
Vpb |PE,min given by Eqs. I|2fci[l and 1)27(1. In a security analysis, we have to assume that a 
"perfect" Eve is able to reach this limit, that is, 

N 

Vq b \q e = V QB]QE ^ in = Gp{xp + 1/V) ( 38a ) 

N 

V Pb1 p e = V PBlPEtmiD = Gq{xq + 1/v) (38b) 

On Alice's side, the relevant conditional variances are given by Eqs. 1221) and (|23[) . Alice's 
and Eve's conditional variances can be converted into mutual informations by using Shannon's 
formula For the quadrature Q, we have 



tQ l^ \Qb) jQ 1, \Qb) 

T BA = 9 l0 S2 77 I BE = 9 lo §2 77 ( 39 ) 

2 V Qb\Q; 2 V ' 
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while, for the quadrature P, we have 

I P BA = \lo g2 ^- /& = |log 2 ^ (40) 

1 V Pb\Pa 1 V Pb\Pe 

Following |181 ITU| , we know that a sufficient condition for reverse reconciliation to give a 
non-zero secret key rate is Ig A > Ig E (for the Q quadrature) or I EA > Ip E (for the P 
quadrature). In terms of conditional variances, this translates into 

Vq b \Q e > Vq b \Qa or V Pb \ Pe >V Pb \ Pa (41) 

Using Eqs. I|22|). \X1'.'\\\ and (|38|l . we obtain (sufficient) conditions for the security of a reverse- 
reconciliation based protocol 

(G QXQ +G QS ){GpXP + ^f) < 1 or [G pX p + G p s)(G qX q + ^) < 1. (42) 

For simplicity reasons, we will assume in the following that all equations are symmetric in Q 
and P, in particular Gq = Gp = G and \Q — Xp — X? a so that these conditions simplify 
into: 

(Gx + Gs)(G X + G/V) <1. (43) 

This condition can be rewritten by using the definition X = Xo + £j where X o = is the 
loss-induced "vacuum noise" and e is the excess noise h , giving 

[1 - G(l - a - e)][l - G(l - i - e)] < 1. (44) 

Since s < 1 and V > 1, this condition is always fulfilled for e — 0, i.e. when the noise only 
originates from losses. This holds for arbitrary high losses (G — > 0) and even for coherent 
state protocols (s = 1). Therefore, reverse reconciliation provides a simple way to extend the 
coherent state protocol of ref. [3] into the high-loss regime. 

Finally, one can show that squeezed state protocols are more robust against excess noise 
than coherent state protocols. Indeed, by solving Eq. Ij44(l . we get 



e < e max with e max = 1 - i -h - \{s- A) + i/A + 4(s- ^) 2 < 1 (45) 



It is easy to check that this upper limit on e is less stringent for low values of s, i.e. for strong 
squeezing. When the squeezing is maximum (s = y), we get £ max = 1— h. Note also that, in 
the limit of high losses (G — > 0), we have e max = 1 — ^(s + y). The maximum tolerable excess 
noise is shown in Fig. as a function of the losses in the limiting case of high modulation 
(V — > oo). 



a Any experimental implementation of this protocol should however estimate these parameters from statistical 
tests, which are likely not to be exactly symmetric. 

b Strictly speaking, e corresponds to the excess noise only in the usual case of losses, where G < 1. 
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Fig. 6. Tolerable excess noise e as a function of the losses at the high modulation limit 
(V S> 1). The RR limit is given by Eq. 1451 . It reduces to e^ax = 1 f° r EPR states (or maximal 
squeezing) at the high modulation limit (s = — > 0), and to Eq. 1511 for coherent states (dashed 
line). The DR security limit defined in Eq. 1601 implies that DR is more robust against excess noise 
than coherent state RR in the low losses regime. The entanglement limit given by Eq. 1591 . i.e. 
e = 2, is well above the previous security limits. In the region 1 < e < 2, no QCV cryptographic 
protocol is known, although entanglement is present. 



4-2 Secret information rates (EPR vs coherent beams) 

The condition (|43J) can directly be translated into a secret information rate by using Shannon's 
formula (in the case where everything is symmetric in Q and P) |24j 



I BA = Ilog 2 M) /B£= ii og2 M) (46 ) 
VB\A Vb\e 

= Ilog 2 ^±* =|log a [(GY + Gx)(Gx + G^)] (47) 

s + X 



The RR secret information rate is therefore 



AI = I BA - Ibb = I log 2 = \ log 2 -771-T77; ~W\ ( 48 ) 

Vb\a (px + Gy) (Gx + Gs) 

and it is strictly positive if the security condition (|43(l is fulfilled. 

Let us compare the cases where Alice uses EPR or coherent beams. If Alice measures 
only one quadrature of an EPR beam (or modulates a maximally squeezed beam compatible 
with the total variance V), we have s — 1/V and e^,™ = 1 — y. Alice and Bob gain 
shared information only every second transmission since they don't always choose the same 
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measurement basis? Therefore, 

A/EPR = i 1082 (Gx + Gy) 2 = \ G^TGj (49) 

= \ l °^ l-G(Ly-e) (50) 
In contrast, for coherent beams, we have s — 1 and 



coh _ 1 _ J_ _ 1_ , _L_ _l I/-, _ 
t max — 2 2V G V G 



1(1 -^) 2 - (51) 



The mutual informations are not dependent of the basis choice (we do not get this prefactor 
1/2), so we have 

2 (Gx + Gy) (Gx + G) 
= A/ EPR -ilog 2 (l + G£) (53) 

Since the excess noise e is positive, we obtain 

A/ coh < AJepr. (54) 

Both secret rates become equal if and only if the noise only comes from losses (e = and 
G < 1). As in HH, the use of entanglement or squeezing does not improve the secret rate for 
losses only, and it becomes advantageous only in the presence of excess noise. 

4-3 Strong losses limit 

Assuming strong losses (G <C 1), Eqs. lf5U|l and (j53|l tend to 



AW * ^ (1 - * - e) AI coh * (1 - i - 2s) (55) 



In the case where there is no excess noise (e = 0), both rates are equal, as we just said, and 
we get A/eprjosscs = A/ co h. losses- If there is some excess noise in the line, one sees that the 
reverse reconciliation protocol is secure as long as as e < 5(1 — y) ~ 1/2 for coherent states, 
and e < 1 — y ~ 1 for EPR beams. This shows again that it is always possible to use coherent 
states regardless the line losses, though EPR beams make the scheme more robust against 
excess noise. 

Now, we may compare the secret key rate of the RR coherent- state protocol with BB84's 
net key rate in the case of a lossy errorless channel, which is \Gn with n = 1 for single photons 
and n -C 1 for weak coherent pulses. Taking for instance a 100 km line with 20 dB loss (G = 
0.01) and a reasonable modulation (V ~ 10), the secret key rate is A7 = 6.5- 10 -3 bit/symbol 
for a RR coherent-state protocol. For the same parameters, the secret key rate for BB84 
with an ideal single-photon source would be at best 5 • 10~ 3 bit/time slot, and one order of 
magnitude smaller using attenuated light pulses with n — 0.1, even with perfect detectors 



c We suppose that Alice and Bob do not have a quantum memory available. 
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(this corresponds to a very recent experimental realization of BB84 |25|). Thus, our reversed- 
reconciliation QCV protocol has, in principle, a comparable efficiency to that of ideal BB84 
(for strong losses and no excess noise). In particular, with a "symbol rate" of a few MHz, 
which should be easy to achieve, the theoretical QCV secret key rate after 100 km would be 
more than 10 kbits/sec. 

We must stress, however, that in order to achieve this rate, better reconciliation protocols 
than those available today should be developed. In their current state, the reconciliation 
procedures cannot extract a single secret bit in such a high-loss regime (the highest loss that 
can be tolerated in the first experimental demonstration of QCV quantum cryptography is 
about 3.1 dB 4 ). Indeed, for the values of the parameters above, the information between 
Alice and Bob is Iab = 6.2 • 10~ 2 bit/symbol, which is one order of magnitude larger than 
AI. Hence, the required reconciliation efficiency should be larger than 90 percent in a regime 
where the information content (Iab) is of a few hundredth of bit per symbol (or, in other 
words, when the signal-to-noise ratio does not exceed about —10 dB). 

5 Entanglement versus security criteria 

5.1 Virtual entanglement criterion 

If the channel between Alice and Bob is too noisy, the virtual entanglement between (Qb, Pb) 
and (Q ! , P') will be destroyed. The threshold at which this happens can be calculated using 
the Duan-Simon entanglement criterion for bivariate gaussian states EZj- This criterion, 
expressed by the equation (17) of is 

(V-1)(Vb-1) <C 2 , (56) 

where 

V B N = (Qb 2 ) = (Pb 2 ) =G(V + x)N (57) 

CN = (Q'Q B ) = -(P'P B ) = VG(V 2 - T)N (58) 

In our case, this leads to 

G(V — 1)(V — 1 + e) < G(V — 1)(V + 1) & e<2 (59) 

Therefore, virtual entanglement is present as soon as there is non-zero modulation (V > 1) 
and non-zero transmission (G > 0), provided that the excess noise of the channel is smaller 
than twice the shot-noise limit. 

5.2 Security criteria 

The security limit against gaussian individual attacks of the QKD protocols discussed in 
0J El are simply obtained by comparing conditional variances. For direct protocols 
[3| , an argument linked to cloning leads to the limit [3 

x <i «■ e<2 ~h- (60) 

which ensures that the inequality (|59|l is fulfilled. For reverse protocols, the inequality (|45|) 
cannot be fulfilled if e > 1 so that the entanglement condition e < 2 is also always fulfilled 
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when reverse reconciliation is possible. This situation is summarized in Fig. El where the 
entanglement limit is compared with the DR and RR security limits. The figure makes clear 
that the DR and RR cryptographic security thresholds lie well within the entanglement region, 
where the channel is able to distribute quantum entanglement. This holds even if no entangled 
beams are physically implemented. 

It is worth noting that the entanglement threshold is known to coincide, physically, with 
an intercept-and-resend attack [2Ej- In other words, at the point where the joint state of Alice 
and Bob becomes separable (e = 2), there exists an explicit intercept-and-resend attack, so 
that obviously no protocol can be secure. The gap between the entanglement condition (|55|) 
and the security limits (|60|) and l|44|) corresponds to a region where the known DR and RR 
protocols are insecure with respect to gaussian attacks, though intercept-and-resend attacks 
cannot be used yet. It is presently unknown whether improved protocols may be devised, 
that would remain secure against gaussian attacks in this region. 

6 Conclusion 

In this paper we have shown that reverse reconciliation protocols can be used to extract a 
secret key from the exchange of coherent, squeezed or EPR beams between Alice and Bob. 
The key is secure against individual gaussian attacks regardless the transmission of the optical 
line between Alice and Bob, provided that the excess noise (i.e. the noise beyond the loss- 
induced vacuum noise) is not too large. Squeezing or entanglement allow these protocols 
to tolerate a larger amount of excess noise, but they are not absolutely required. We have 
also shown that the QCV protocols based on gaussian displaced squeezed or coherent states 
[31 0] H3 El m are equivalent to entangled-beams based protocols, and that the security limits 
of these protocols are more severe than the entanglement limit of the equivalent entanglement- 
based protocol. This result is certainly compatible with — and even supports — the idea that 
they may be unconditionally secure |2.'i|. 

The difference between the entanglement condition and the security limits in RR or DR 
shows that our protocols do not use the full available entanglement. In principle, procedures 
based either on quantum entanglement distillation |12II22| or on classical advantage distillation 
[221 can exploit the entanglement up to its ultimate limit. However, it should be noticed 
that such protocols are either much more difficult to implement (quantum entanglement 
distillation) than the ones we have considered here, or have extremely low practical secret bit 
rates (classical advantage distillation). It remains an open question to determine whether the 
gap between our security threshold and the entanglement threshold is due to the restricted 
observables we can measure through homodyne detection, or to the reconciliation procedure 
used to extract the bits, or perhaps to another factor. 
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